Directory system

• US 7,620,630 B2
• Filed: 11/12/2003
• Issued: 11/17/2009
• Est. Priority Date: 11/12/2003
• Status: Expired due to Fees

• Current Assignee: Oliver Lloyd Pty Ltd
• Original Assignee: Oliver Lloyd Pty Ltd
• Inventors: Oliver, Susan M., Lloyd, Alan C.
• Primary Examiner(s): Vo; Tim T.
• Assistant Examiner(s): Ahn; Sangwoo
• Application Number:
  US10/705,242
• Publication Number:
  US 20050102297A1
• Time in Patent Office: 2,197 Days
• Field of Search: 707 1- 10, 707100-1041
• US Class Current: 1/1
• CPC Class Codes: G06F 16/10 File systems; File servers
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: Y10S 707/99934 Query formulation, input preparation, or translation
• CPC Class Codes: Y10S 707/99935 Query augmenting and refining, e.g. inexact access
• CPC Class Codes: Y10S 707/99942 Manipulating data structure, e.g. compression, compaction, compilation

Abstract

A directory system for providing directory services in a communications network, including a plurality of memory segments for storing respective subsets of directory data for each directory object. The memory segments include attribute segments, object segments, and directory information tree (DIT) segments for respectively storing attribute, management, and hierarchical structure data for directory objects. The directory system monitors usage of directory data stored in the memory segments and redistributes at least a portion of the directory data in the memory segments based on the observed usage to improve the performance of directory services. The directory system also provides transactional messaging services to users.

Claims

1. A method for storage and retrieval of directory data in a directory system running on at least one processor having access to at least one data storage device and at least one communications network with interfaces to at least one application running on other processors having need of directory system services, said method comprising:

running plural intelligent directory service modules as a part of said directory system, said intelligent directory service modules comprising (a) an identity management module, (b) a presence management module, and (c) a messaging management module;

storing data objects used by the directory service modules in respectively corresponding different organized logical segments of memory, each segment containing object attribute data needed by the corresponding directory service module to perform its intelligent service in response to an incoming request;

receiving directory service requests from said application(s) running on said other processors, said requests including an identification of the type of requested directory service comprising (a) identity service, (b) presence service, and (c) messaging service;

directing received directory service requests to the directory service module respectively corresponding to the identified type of requested directory service; and

returning responses to incoming requests based on the outputs of at least one intelligent directory service module without requiring access of other object attribute data separately stored for another of the intelligent directory service modules.

2. A method as in claim 1, wherein said intelligent directory service modules provide customized virtual machines within said directory service.

3. A method as in claim 1, wherein data storage and processing methods practiced by said intelligent directory service modules are embodied within solid state integrated circuits.

4. A method as in claim 1, wherein said different organized logical segments of memory containing object attribute data associated with corresponding different intelligent directory services are, in turn, logical segments of memory providing a directory information tree (DIT).

5. A method as in claim 4, wherein said DIT is used to locate the logical segment of memory corresponding to the requested intelligent directory service and to access the object attribute data associated therewith.

6. A method as in claim 1, wherein said object attribute data includes data indicating whether each of said attributes is associated with one or more other attributes.

7. A method as in claim 1, wherein said attribute data includes data indicating whether each of said attributes is a sponsoring attribute for one or more other attributes.

8. A method as claimed in claim 1, wherein attributes having directory object naming characteristics in common are stored together.

9. A method as in claim 8, wherein the directory object naming characteristics correspond to one of:

distinguished name attributes, aliased distinguished names, and non-naming attributes.

10. A method as in claim 1, wherein one of the intelligent directory services provides security services and uses its own security attribute data corresponding to one of:

collective attributes, compound attributes, attributes of compound attributes, X.500/LDAP operational attributes, user operational attributes, sponsoring attributes.

11. A method as in claim 1, wherein said segments include a first segment for storing distinct name binding rules, access control information, object schema and management data for said directory objects.

12. A method as in claim 11, wherein one of the intelligent directory services provides configuration services with said schema and management data to configure said object attribute data according to processing requirements of said intelligent directory services.

13. A method as in claim 4, wherein:

the directory system generates a directory operation access control identifier for use in determining whether a user is granted access to perform a selected directory operation on a selected attribute type in a selected portion of a DIT, said directory operation access control identifier identifying said directory operation, said portion of said DIT and said attribute type, and

the directory system determines whether said access is granted on the basis of a comparison of said directory operation access control identifier with one or more access control identifiers associated with one or more of said portion of said DIT, said attribute type, and an attribute type group including said attribute type.

14. A method as in claim 1, wherein:

the directory system is adapted to generate one or more access control identifiers for a user on the basis of access configuration information for a user, and

a trusted operating system is used to determine said user'"'"'s access to a directory object on the basis of access control identifiers associated with said object and said user.

15. A method as in claim 1, wherein said memory segments include transaction segments dedicated to storage of transaction data representing phases of a directory transaction to allow recovery of said directory transaction.

16. A method as in claim 1, including an adaptation component for automatically reconfiguring said memory segments on the basis of usage of said memory segments.

17. A method as in claim 1, wherein said memory segments include at east one adaptation segment dedicated to storage of adaptation data representing the usage of said memory segments.

18. A method as in claim 17, wherein said adaptation data represents the organization of directory data stored in said memory segments.

19. A method in claim 16, wherein said reconfiguring includes segregating one or more portions of said directory data on the basis of access frequencies for said one or more portions of said directory data.

20. A method as in claim 16, wherein said reconfiguring includes segregating one or more portions of directory data based on the number of instances of an entity of said directory data in a region of memory.

21. A method as in claim 16, wherein said reconfiguring includes segregating instances of an attribute type from a name space into two or more regions of memory.

22. A method as in claim 1, including modules for accessing and managing said plurality of memory segments.

23. A method as in claim 22, including a composite attribute module for managing composite attributes and extracting from said composite attributes particular attributes for storage in an associated object attribute data segment.

24. A method as in claim 22, including a statistical module for generating statistical data in relation to directory entries.

25. A method as in claim 22, including a monitoring module for monitoring one or more directory entries and for generating notification data in response to modification of a monitored directory entry.

26. A method as in claim 22, including a collective attributes module for segregating collective attributes of entries within a name space.

27. A method as in claim 22, including a X.509 certificate validation module for validating one or more certificate paths.

28. A method as in claim 22, including a multi-object management module for processing two or more objects as an entity.

29. A method as in claim 28, wherein said two or more objects include a sponsoring object and one or more sponsored objects.

30. A method as in claim 29, wherein said multi-object management module is adapted to automatically generate said one or more sponsored objects when a sponsoring object is generated.

31. A method as in claim 30, wherein said multi-object module is adapted to automatically generate one or more objects related to a user object when said user object is generated.

32. A method as in claim 31, wherein said user object represents a user, and said one or more objects represent one or more services for said user.

33. A method as in claim 1, including a service authorization module for determining whether a user is authorized to use one or more services.

34. A method as in claim 33, wherein said service authorization module is adapted to perform said determining in response to a directory search.

35. A method as in claim 34, wherein said directory search is based on an authorization matching rule, service and device properties, and an authorization token.

36. A method as in claim 1, including a relational search module for performing a distributed object relational search in response to a search query including relational operators.

37. A method as in claim 1, wherein the identity-based service components include a user presence management component that maintains presence attributes of said users, said presence attributes including an attribute that indicates whether a user is using a directory.

38. A method as in claim 37, wherein said user presence management component generates one or more events in response to a change in said user presence attributes for each user.

39. A method as in claim 1, wherein the message-based service component includes a message transfer component that enables the message attributes of said directory objects to be transferred to other directory objects.

40. A method as in claim 1, including at least one attribute processor adapted to store and process attribute data of a directory.

41. A method as in claim 40, wherein said attribute processor includes an application-specific integrated circuit.

42. Computer-readable storage media storing executable computer program code which, when executed, performs the method of claim 1.

43. Apparatus for storage and retrieval of directory data comprising a directory system running on at least one processor having access to at least one data storage device and at least one communications network with interfaces to one or more applications running on other processors having need of directory system services, said apparatus comprising:

plural intelligent directory service modules running as a part of said directory system, said intelligent directory service modules comprising (a) an identity management module, (b) a presence management module, and (c) a messaging management module;

memory storing data objects used by the directory service modules in respectively corresponding different organized logical segments of memory, each segment containing object attribute data needed by the corresponding directory service module to perform its intelligent service in response to an incoming request;

at least one data input receiving directory service requests from said application(s) running on said other processors, said requests including an identification of the type of requested directory service comprising (a) identity service, (b) presence service, and (c) messaging service;

means for directing received directory service requests to the directory service module respectively corresponding to the identified type of requested directory service; and

means for returning responses to incoming requests based on the outputs of at least one intelligent directory service module without requiring access of other object attribute data separately stored for another of the intelligent directory service modules.

44. Apparatus as in claim 43, wherein said intelligent directory service modules provide customized virtual machines within said directory service.

45. Apparatus as in claim 43, wherein data storage and processing methods practiced by said intelligent directory service modules are embodied within solid state integrated circuits.

46. Apparatus as in claim 43, wherein said different organized logical segments of memory containing object attribute data associated with corresponding different intelligent directory services are, in turn, logical segments of memory providing a directory information tree (DIT).

47. Apparatus as in claim 46, wherein said DIT is used to locate the logical segment of memory corresponding to the requested intelligent directory service and to access the object attribute data associated therewith.

48. Apparatus as in claim 43, wherein said object attribute data includes data indicating whether each of said attributes is associated with one or more other attributes.

49. Apparatus as in claim 43, wherein said attribute data includes data indicating whether each of said attributes is a sponsoring attribute for one or more other attributes.

50. Apparatus as claimed in claim 43, wherein attributes having directory object naming characteristics in common are stored together.

51. Apparatus as in claim 50, wherein the directory object naming characteristics correspond to one of:

distinguished name attributes, aliased distinguished names, and non-naming attributes.

52. Apparatus as in claim 50, wherein one of the intelligent directory services provides security services and uses its own security attribute data corresponding to one of:

collective attributes, compound attributes, attributes of compound attributes, X.500/LDAP operational attributes, user operational attributes, sponsoring attributes.

53. Apparatus as in claim 43, wherein said segments include a first segment for storing distinct name binding rules, access control information, object schema and management data for said directory objects.

54. Apparatus as in claim 53, wherein one of the intelligent directory services provides configuration services with said schema and management data to configure said object attribute data according to processing requirements of said intelligent directory services.

55. Apparatus as in claim 46, wherein:

the directory system generates a directory operation access control identifier for use in determining whether a user is granted access to perform a selected directory operation on a selected attribute type in a selected portion of a DIT, said directory operation access control identifier identifying said directory operation, said portion of said DIT and said attribute type, and

the directory system determines whether said access is granted on the basis of a comparison of said directory operation access control identifier with one or more access control identifiers associated with one or more of said portion of said DIT, said attribute type, and an attribute type group including said attribute type.

56. Apparatus as in claim 43, wherein

the directory system is adapted to generate one or more access control identifiers for a user on the basis of access configuration information for a user, and

a trusted operating system is used to determine said user'"'"'s access to a directory object on the basis of access control identifiers associated with said object and said user.

57. Apparatus as in claim 43, wherein said memory segments include transaction segments dedicated to storage of transaction data representing phases of a directory transaction to allow recovery of said directory transaction.

58. Apparatus as in claim 43, including an adaptation component for automatically reconfiguring said memory segments on the basis of usage of said memory segments.

59. Apparatus as in claim 43, wherein said memory segments include at least one adaptation segment dedicated to storage of adaptation data representing the usage of said memory segments.

60. Apparatus as in claim 59, wherein said adaptation data represents the organization of directory data stored in said memory segments.

61. Apparatus as in claim 58, wherein said reconfiguring includes segregating one or more portions of said directory data on the basis of access frequencies for said one or more portions of said directory data.

62. Apparatus as in claim 58, wherein said reconfiguring includes segregating one or more portions of directory data based on the number of instances of an entity of said directory data in a region of memory.

63. Apparatus as in claim 58, wherein said reconfiguring includes segregating instances of an attribute type from a name space into two or more regions of memory.

64. Apparatus as in claim 43, including intelligent directory service modules for accessing and managing said plurality of memory segments.

65. Apparatus as in claim 64, including a composite attribute module for managing composite attributes and extracting from said composite attributes particular attributes for storage in an associated object attribute data segment.

66. Apparatus as in claim 64, including a statistical module for generating statistical data in relation to directory entries.

67. Apparatus as in claim 64, including a monitoring module for monitoring one or more directory entries and for generating notification data in response to modification of a monitored directory entry.

68. Apparatus as in claim 64, including a collective attributes module for segregating collective attributes of entries within a name space.

69. Apparatus as in claim 64, including a X.509 certificate validation module for validating one or more certificate paths.

70. Apparatus as in claim 64, including a multi-object management module for processing two or more objects as an entity.

71. Apparatus as in claim 70, wherein said two or more objects include a sponsoring object and one or more sponsored objects.

72. Apparatus as in claim 71, wherein said multi-object management module is adapted to automatically generate said one or more sponsored objects when a sponsoring object is generated.

73. Apparatus as in claim 72, wherein said multi-object module is adapted to automatically generate one or more objects related to a user object when said user object is generated.

74. Apparatus as in claim 73, wherein said user object represents a user, and said one or more objects represent one or more services for said user.

75. Apparatus as in claim 43, including a service authorization module for determining whether a user is authorized to use one or more services.

76. Apparatus as in claim 75, wherein said service authorization module is adapted to perform said determining in response to a directory search.

77. Apparatus as in claim 76, wherein said directory search is based on an authorization matching rule, service and device properties, and an authorization token.

78. Apparatus as in claim 43, including a relational search module for performing a distributed object relational search in response to a search query including relational operators.

79. Apparatus as in claim 43, wherein the identity-based service components include a user presence management component that maintains presence attributes of said users, said presence attributes including an attribute that indicates whether a user is using a directory.

80. Apparatus as in claim 79, wherein said user presence management component generates one or more events in response to a change in said user presence attributes for each user.

81. Apparatus as in claim 43, wherein the message-based service component includes a message transfer component that enables the message attributes of said directory objects to be transferred to other directory objects.

82. Apparatus as in claim 43, including at least one attribute processor adapted to store and process attribute data of a directory.

83. Apparatus as in claim 82, wherein said attribute processor includes an application-specific integrated circuit.